Active Directory Federation Services (AD FS) Spoofing Vulnerability
Priority LOW 35CWE-295Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-295.
Summary
Improper certificate validation (CWE-295) in Active Directory Federation Services (AD FS) lets an unauthorized attacker perform spoofing over a network. The CVSS 3.1 base score is 7.4 (HIGH), with high attack complexity, no privileges or user interaction required, and high confidentiality and integrity impact. CISA has not added it to KEV, and its SSVC assessment lists exploitation as none, automatable as no, and technical impact as total. Red Hat rates it Important.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00586 48th percentileScored 2026-11-07
Fix Fixed Microsoft .NET Framework 3.5 (Microsoft): 2.0.50727.9188 AND 3.0.30729.9171Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 (Microsoft): 2.0.50727.8987 AND 3.0.30729.8982 AND 4.7.4150.0+21 more productsRed Hat: 7 advisories
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Microsoft | Microsoft .NET Framework 3.5 | 3.5.0 to before 2.0.50727.9188 AND 3.0.30729.9171 | 2.0.50727.9188 AND 3.0.30729.9171 | Patch available | CNA |
| Microsoft | Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 | 3.0.0.0 to before 2.0.50727.8987 AND 3.0.30729.8982 AND 4.7.4150.0 | 2.0.50727.8987 AND 3.0.30729.8982 AND 4.7.4150.0 | Patch available | CNA |
| Microsoft | Microsoft .NET Framework 3.5 AND 4.7.2 | 4.7.0 to before 2.0.50727.9073 AND 3.0.30729.9070 AND 4.7.4150.0 | 2.0.50727.9073 AND 3.0.30729.9070 AND 4.7.4150.0 | Patch available | CNA |
| Microsoft | Microsoft .NET Framework 3.5 AND 4.8 | 4.8.0 to before 2.0.50727.9073 AND 3.0.30729.9070 AND 4.8.4811.0 | 2.0.50727.9073 AND 3.0.30729.9070 AND 4.8.4811.0 | Patch available | CNA |
| Microsoft | Microsoft .NET Framework 3.5 AND 4.8.1 | 4.8.1 to before 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0 | 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0 | Patch available | CNA |
| Microsoft | Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 | 4.7.0 to before 4.7.4150.0 | 4.7.4150.0 | Patch available | CNA |
| Microsoft | Microsoft .NET Framework 4.8 | 4.8.0 to before 4.8.4811.0 | 4.8.4811.0 | Patch available | CNA |
| Microsoft | Microsoft .NET Framework 4.8.1 | 4.8.0.0 to before 4.8.9363.0 | 4.8.9363.0 | Patch available | CNA |
| Microsoft | Microsoft Visual Studio 2022 version 17.14 | 17.14.0 to before 17.14.42 | 17.14.42 | Patch available | CNA |
| Microsoft | Microsoft Visual Studio 2026 version 18.10 | 18.10.0 to before 18.10.4 | 18.10.4 | Patch available | CNA |
| Microsoft | System.Security.Cryptography.Xml | 10.0.0 to before 8.0.5 | 8.0.5 | Patch available | CNA |
| Microsoft | Windows 10 Version 1607 | 10.0.14393.0 to before 10.0.14393.9612 | 10.0.14393.9612 | Patch available | CNA |
| Microsoft | Windows 10 Version 1809 | 10.0.17763.0 to before 10.0.17763.9376 | 10.0.17763.9376 | Patch available | CNA |
| Microsoft | Windows Server 2012 R2 | 6.3.9600.0 to before 6.3.9600.23470 | 6.3.9600.23470 | Patch available | CNA |
| Microsoft | Windows Server 2012 R2 (Server Core installation) | 6.3.9600.0 to before 6.3.9600.23470 | 6.3.9600.23470 | Patch available | CNA |
| Microsoft | Windows Server 2016 | 10.0.14393.0 to before 10.0.14393.9612 | 10.0.14393.9612 | Patch available | CNA |
| Microsoft | Windows Server 2016 (Server Core installation) | 10.0.14393.0 to before 10.0.14393.9612 | 10.0.14393.9612 | Patch available | CNA |
| Microsoft | Windows Server 2019 | 10.0.17763.0 to before 10.0.17763.9376 | 10.0.17763.9376 | Patch available | CNA |
| Microsoft | Windows Server 2019 (Server Core installation) | 10.0.17763.0 to before 10.0.17763.9376 | 10.0.17763.9376 | Patch available | CNA |
| Microsoft | Windows Server 2022 | 10.0.20348.0 to before 10.0.20348.5761 | 10.0.20348.5761 | Patch available | CNA |
| Microsoft | Windows Server 2025 | 10.0.26100.0 to before 10.0.26100.33650 | 10.0.26100.33650 | Patch available | CNA |
| Microsoft | Windows Server 2025 (Server Core installation) | 10.0.26100.0 to before 10.0.26100.33650 | 10.0.26100.33650 | Patch available | CNA |
| — | System.Security.Cryptography.Xml (NuGet) | 8.0.0 to before 8.0.5 | 8.0.5 | Patch available | GHSA-vrv5-2jg9-4mmr |
- Microsoft .NET Framework 3.5 VendorMicrosoft Affected 3.5.0 to before 2.0.50727.9188 AND 3.0.30729.9171 Fixed in 2.0.50727.9188 AND 3.0.30729.9171 Patch available CNA
- Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 VendorMicrosoft Affected 3.0.0.0 to before 2.0.50727.8987 AND 3.0.30729.8982 AND 4.7.4150.0 Fixed in 2.0.50727.8987 AND 3.0.30729.8982 AND 4.7.4150.0 Patch available CNA
- Microsoft .NET Framework 3.5 AND 4.7.2 VendorMicrosoft Affected 4.7.0 to before 2.0.50727.9073 AND 3.0.30729.9070 AND 4.7.4150.0 Fixed in 2.0.50727.9073 AND 3.0.30729.9070 AND 4.7.4150.0 Patch available CNA
- Microsoft .NET Framework 3.5 AND 4.8 VendorMicrosoft Affected 4.8.0 to before 2.0.50727.9073 AND 3.0.30729.9070 AND 4.8.4811.0 Fixed in 2.0.50727.9073 AND 3.0.30729.9070 AND 4.8.4811.0 Patch available CNA
- Microsoft .NET Framework 3.5 AND 4.8.1 VendorMicrosoft Affected 4.8.1 to before 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0 Fixed in 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0 Patch available CNA
- Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 VendorMicrosoft Affected 4.7.0 to before 4.7.4150.0 Fixed in 4.7.4150.0 Patch available CNA
- Microsoft .NET Framework 4.8 VendorMicrosoft Affected 4.8.0 to before 4.8.4811.0 Fixed in 4.8.4811.0 Patch available CNA
- Microsoft .NET Framework 4.8.1 VendorMicrosoft Affected 4.8.0.0 to before 4.8.9363.0 Fixed in 4.8.9363.0 Patch available CNA
- Microsoft Visual Studio 2022 version 17.14 VendorMicrosoft Affected 17.14.0 to before 17.14.42 Fixed in 17.14.42 Patch available CNA
- Microsoft Visual Studio 2026 version 18.10 VendorMicrosoft Affected 18.10.0 to before 18.10.4 Fixed in 18.10.4 Patch available CNA
- System.Security.Cryptography.Xml VendorMicrosoft Affected 10.0.0 to before 8.0.5 Fixed in 8.0.5 Patch available CNA
- Windows 10 Version 1607 VendorMicrosoft Affected 10.0.14393.0 to before 10.0.14393.9612 Fixed in 10.0.14393.9612 Patch available CNA
- Windows 10 Version 1809 VendorMicrosoft Affected 10.0.17763.0 to before 10.0.17763.9376 Fixed in 10.0.17763.9376 Patch available CNA
- Windows Server 2012 R2 VendorMicrosoft Affected 6.3.9600.0 to before 6.3.9600.23470 Fixed in 6.3.9600.23470 Patch available CNA
- Windows Server 2012 R2 (Server Core installation) VendorMicrosoft Affected 6.3.9600.0 to before 6.3.9600.23470 Fixed in 6.3.9600.23470 Patch available CNA
- Windows Server 2016 VendorMicrosoft Affected 10.0.14393.0 to before 10.0.14393.9612 Fixed in 10.0.14393.9612 Patch available CNA
- Windows Server 2016 (Server Core installation) VendorMicrosoft Affected 10.0.14393.0 to before 10.0.14393.9612 Fixed in 10.0.14393.9612 Patch available CNA
- Windows Server 2019 VendorMicrosoft Affected 10.0.17763.0 to before 10.0.17763.9376 Fixed in 10.0.17763.9376 Patch available CNA
- Windows Server 2019 (Server Core installation) VendorMicrosoft Affected 10.0.17763.0 to before 10.0.17763.9376 Fixed in 10.0.17763.9376 Patch available CNA
- Windows Server 2022 VendorMicrosoft Affected 10.0.20348.0 to before 10.0.20348.5761 Fixed in 10.0.20348.5761 Patch available CNA
- Windows Server 2025 VendorMicrosoft Affected 10.0.26100.0 to before 10.0.26100.33650 Fixed in 10.0.26100.33650 Patch available CNA
- Windows Server 2025 (Server Core installation) VendorMicrosoft Affected 10.0.26100.0 to before 10.0.26100.33650 Fixed in 10.0.26100.33650 Patch available CNA
- System.Security.Cryptography.Xml (NuGet) Vendor— Affected 8.0.0 to before 8.0.5 Fixed in 8.0.5 Patch available GHSA-vrv5-2jg9-4mmr
CPE configurations NVD · 40
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:* | before 10.0.14393.9612 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:* | before 10.0.14393.9612 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:* | before 10.0.17763.9376 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:* | before 10.0.17763.9376 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:* | r2 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:x64:* | before 10.0.14393.9612 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:x64:* | before 10.0.17763.9376 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:x64:* | before 10.0.20348.5761 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:x64:* | before 10.0.26100.33650 | Vulnerable | Microsoft |
- cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:* Versions before 10.0.14393.9612 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:* Versions before 10.0.14393.9612 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:* Versions before 10.0.17763.9376 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:* Versions before 10.0.17763.9376 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:* Versions r2 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:x64:* Versions before 10.0.14393.9612 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:x64:* Versions before 10.0.17763.9376 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:x64:* Versions before 10.0.20348.5761 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:x64:* Versions before 10.0.26100.33650 Vulnerable ·Microsoft
Show 30 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:* | 8.0.0 to before 8.0.5 | Vulnerable | Microsoft |
| cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Apple |
| cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Linux |
| cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:-:*:* | 17.14.0 to before 17.14.42 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:visual_studio_2026:*:*:*:*:*:-:*:* | 18.10.0 to before 18.10.4 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:.net_framework:4.8.1:*:*:*:*:*:*:* | 4.8.1 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_11_26h1:-:*:*:*:*:*:arm64:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_11_26h1:-:*:*:*:*:*:x64:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:a:microsoft:.net_framework:4.8:*:*:*:*:*:*:* | 4.8 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:* | r2 | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:a:microsoft:.net_framework:4.6.2:*:*:*:*:*:*:* | 4.6.2 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:.net_framework:4.7:*:*:*:*:*:*:* | 4.7 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:.net_framework:4.7.1:*:*:*:*:*:*:* | 4.7.1 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:.net_framework:4.7.2:*:*:*:*:*:*:* | 4.7.2 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:.net_framework:3.5:*:*:*:*:*:*:* | 3.5 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10_21h2:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10_22h2:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2022:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_11_23h2:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_11_24h2:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_11_25h2:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_11_26h2:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2025:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_11_26h1:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
- cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:* Versions 8.0.0 to before 8.0.5 Vulnerable ·Microsoft
- cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Apple
- cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Linux
- cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:-:*:* Versions 17.14.0 to before 17.14.42 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:visual_studio_2026:*:*:*:*:*:-:*:* Versions 18.10.0 to before 18.10.4 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:.net_framework:4.8.1:*:*:*:*:*:*:* Versions 4.8.1 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_11_26h1:-:*:*:*:*:*:arm64:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_11_26h1:-:*:*:*:*:*:x64:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:a:microsoft:.net_framework:4.8:*:*:*:*:*:*:* Versions 4.8 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:* Versions r2 Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:a:microsoft:.net_framework:4.6.2:*:*:*:*:*:*:* Versions 4.6.2 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:.net_framework:4.7:*:*:*:*:*:*:* Versions 4.7 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:.net_framework:4.7.1:*:*:*:*:*:*:* Versions 4.7.1 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:.net_framework:4.7.2:*:*:*:*:*:*:* Versions 4.7.2 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:.net_framework:3.5:*:*:*:*:*:*:* Versions 3.5 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10_21h2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10_22h2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2022:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_11_23h2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_11_24h2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_11_25h2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_11_26h2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2025:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_11_26h1:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
Remediation
Install the Microsoft fixed builds for each affected product. Windows 10 Version 1809 is fixed in 10.0.17763.9376, Windows Server 2012 R2 in 6.3.9600.23470, and Microsoft .NET Framework 4.8.1 in 4.8.9363.0, since earlier builds are affected. Red Hat has released fixes for Red Hat Enterprise Linux 10 in RHSA-2026:86168 and for Red Hat Enterprise Linux 9 in RHSA-2026:86169.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
- Fix · CNA Microsoft .NET Framework 3.5 (Microsoft) Fixed in 2.0.50727.9188 AND 3.0.30729.9171
- Fix · CNA Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 (Microsoft) Fixed in 2.0.50727.8987 AND 3.0.30729.8982 AND 4.7.4150.0
- Fix · CNA Microsoft .NET Framework 3.5 AND 4.7.2 (Microsoft) Fixed in 2.0.50727.9073 AND 3.0.30729.9070 AND 4.7.4150.0
- Fix · CNA Microsoft .NET Framework 3.5 AND 4.8 (Microsoft) Fixed in 2.0.50727.9073 AND 3.0.30729.9070 AND 4.8.4811.0
- Fix · CNA Microsoft .NET Framework 3.5 AND 4.8.1 (Microsoft) Fixed in 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0
- Fix · CNA Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 (Microsoft) Fixed in 4.7.4150.0
- Fix · CNA Microsoft .NET Framework 4.8 (Microsoft) Fixed in 4.8.4811.0
- Fix · CNA Microsoft .NET Framework 4.8.1 (Microsoft) Fixed in 4.8.9363.0
- Fix · CNA Microsoft Visual Studio 2022 version 17.14 (Microsoft) Fixed in 17.14.42
- Fix · CNA Microsoft Visual Studio 2026 version 18.10 (Microsoft) Fixed in 18.10.4
- Fix · CNA System.Security.Cryptography.Xml (Microsoft) Fixed in 8.0.5
- Fix · CNA Windows 10 Version 1607 (Microsoft) Fixed in 10.0.14393.9612
- Fix · CNA Windows 10 Version 1809 (Microsoft) Fixed in 10.0.17763.9376
- Fix · CNA Windows Server 2012 R2 (Microsoft) Fixed in 6.3.9600.23470
- Fix · CNA Windows Server 2012 R2 (Server Core installation) (Microsoft) Fixed in 6.3.9600.23470
- Fix · CNA Windows Server 2016 (Microsoft) Fixed in 10.0.14393.9612
- Fix · CNA Windows Server 2016 (Server Core installation) (Microsoft) Fixed in 10.0.14393.9612
- Fix · CNA Windows Server 2019 (Microsoft) Fixed in 10.0.17763.9376
- Fix · CNA Windows Server 2019 (Server Core installation) (Microsoft) Fixed in 10.0.17763.9376
- Fix · CNA Windows Server 2022 (Microsoft) Fixed in 10.0.20348.5761
- Fix · CNA Windows Server 2025 (Microsoft) Fixed in 10.0.26100.33650
- Fix · CNA Windows Server 2025 (Server Core installation) (Microsoft) Fixed in 10.0.26100.33650
- Fix · GHSA-vrv5-2jg9-4mmr System.Security.Cryptography.Xml (NuGet) Fixed in 8.0.5 Advisory →
Red Hat 7 advisories
- RHSA-2026:88474 Released 2026-10-22 · Red Hat rating Critical.NET 8.0 security update
- Red Hat Enterprise Linux AppStream EUS (v. 10.0) aspnetcore-runtime-8.0-8.0.32-1.el10_0, aspnetcore-runtime-dbg-8.0-8.0.32-1.el10_0, aspnetcore-targeting-pack-8.0-8.0.32-1.el10_0 +9
- Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) dotnet-sdk-8.0-source-built-artifacts-8.0.132-1.el10_0
- RHSA-2026:88422 Released 2026-10-22 · Red Hat rating Critical.NET 8.0 security update
- Red Hat CodeReady Linux Builder EUS (v.9.6) dotnet-sdk-8.0-source-built-artifacts-8.0.132-1.el9_6
- Red Hat Enterprise Linux AppStream EUS (v.9.6) aspnetcore-runtime-8.0-8.0.32-1.el9_6, aspnetcore-runtime-dbg-8.0-8.0.32-1.el9_6, aspnetcore-targeting-pack-8.0-8.0.32-1.el9_6 +9
- RHSA-2026:88425 Released 2026-10-22 · Red Hat rating Critical.NET 8.0 security update
- Red Hat Enterprise Linux AppStream E4S (v.9.4) aspnetcore-runtime-8.0-8.0.32-1.el9_4, aspnetcore-runtime-dbg-8.0-8.0.32-1.el9_4, aspnetcore-targeting-pack-8.0-8.0.32-1.el9_4 +11
Show 4 more Red Hat advisories
- RHSA-2026:86594 Released 2026-10-21 · Red Hat rating Critical.NET 8.0 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 8) aspnetcore-runtime-8.0-8.0.32-2.el8_10, aspnetcore-runtime-dbg-8.0-8.0.32-2.el8_10, aspnetcore-targeting-pack-8.0-8.0.32-2.el8_10 +9
- Red Hat Enterprise Linux CRB (v. 8) dotnet-sdk-8.0-source-built-artifacts-8.0.132-2.el8_10
- RHSA-2026:86169 Released 2026-10-20 · Red Hat rating Critical.NET 8.0 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 9) aspnetcore-runtime-8.0-8.0.32-1.el9_8, aspnetcore-runtime-dbg-8.0-8.0.32-1.el9_8, aspnetcore-targeting-pack-8.0-8.0.32-1.el9_8 +9
- Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) dotnet-sdk-8.0-source-built-artifacts-8.0.132-1.el9_8
- RHSA-2026:86168 Released 2026-10-20 · Red Hat rating Critical.NET 8.0 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 10) aspnetcore-runtime-8.0-8.0.32-1.el10_2, aspnetcore-runtime-dbg-8.0-8.0.32-1.el10_2, aspnetcore-targeting-pack-8.0-8.0.32-1.el10_2 +9
- Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) dotnet-sdk-8.0-source-built-artifacts-8.0.132-1.el10_2
- RHSA-2026:84693 Released 2026-10-19 · Red Hat rating ImportantRed Hat Hardened Images RPMs Security Update
- Red Hat Hardened Images aspnetcore-runtime-8.0-8.0.32-0.1.hum1@aarch64, aspnetcore-runtime-8.0-8.0.32-0.1.hum1@x86_64, aspnetcore-runtime-dbg-8.0-8.0.32-0.1.hum1@aarch64 +22
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat CodeReady Linux Builder EUS (v.9.6) | Fixed | RHSA-2026:88422 |
| Red Hat Enterprise Linux AppStream (v. 10) | Fixed | RHSA-2026:86168 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2026:86594 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2026:86169 |
| Red Hat Enterprise Linux AppStream E4S (v.9.4) | Fixed | RHSA-2026:88425 |
| Red Hat Enterprise Linux AppStream EUS (v. 10.0) | Fixed | RHSA-2026:88474 |
| Red Hat Enterprise Linux AppStream EUS (v.9.6) | Fixed | RHSA-2026:88422 |
| Red Hat Enterprise Linux CRB (v. 8) | Fixed | RHSA-2026:86594 |
| Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) | Fixed | RHSA-2026:86168 |
| Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) | Fixed | RHSA-2026:86169 |
| Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) | Fixed | RHSA-2026:88474 |
| Red Hat Hardened Images | Fixed | RHSA-2026:84693 |
Not affected: 1 product
- Red Hat Hardened Images
Timeline
- 2026-10-13 Threatist record created from CVE-2026-96222
- 2026-10-13 Alias added: GHSA-vrv5-2jg9-4mmr
- 2026-10-13 Fix available: NuGet/[email protected] · GHSA-vrv5-2jg9-4mmr
- 2026-10-13 CVSS score added · GHSA-vrv5-2jg9-4mmr
- 2026-10-13 Weakness changed · GHSA-vrv5-2jg9-4mmr
- 2026-10-13 4 new references · GHSA-vrv5-2jg9-4mmr
- 2026-10-14 CISA SSVC decision points changed
- 2026-10-14 Priority changed: MEDIUM → LOW
- 2026-10-14 CISA SSVC decision points changed
- 2026-10-16 Affected versions changed · Red Hat
- 2026-10-16 CVSS score added · Red Hat
- 2026-10-20 2 new references · GHSA-vrv5-2jg9-4mmr
- 2026-10-20 Fix available: RHSA-2026:84693 · Red Hat
- 2026-10-20 Fix available: Red Hat Hardened Images · Red Hat
- 2026-10-21 Fix available: RHSA-2026:86168 · Red Hat
- 2026-10-21 Fix available: RHSA-2026:86169 · Red Hat
- 2026-10-21 Fix available: RHSA-2026:86594 · Red Hat
- 2026-10-21 Fix available: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux AppStream (v. 9) +3 · Red Hat
- 2026-10-23 Fix available: RHSA-2026:88422 · Red Hat
- 2026-10-23 Fix available: RHSA-2026:88474 · Red Hat
- 2026-10-23 Fix available: RHSA-2026:88425 · Red Hat
- 2026-10-23 Fix available: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream E4S (v.9.4), Red Hat Enterprise Linux AppStream EUS (v. 10.0) +2 · Red Hat
References
More Microsoft .net vulnerabilities
- TI-2026-79288 Out-of-bounds write in Google Brotli decoder KEVCVSS 4.0CRITICAL 9.2
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2023-19596 .NET and Visual Studio Denial of Service Vulnerability KEVCVSS 3.1HIGH 7.5
- TI-2023-19588 Microsoft QUIC Denial of Service Vulnerability CVSS 3.1HIGH 7.5
- TI-2024-14152 .NET and Visual Studio Denial of Service Vulnerability CVSS 3.1HIGH 7.5
- TI-2021-08380 .NET Core Remote Code Execution Vulnerability CVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-96222 · CVE Program
- CVE-2026-96222 · NVD
- FIRST EPSS
- GHSA-vrv5-2jg9-4mmr · GitHub Advisory Database · CC BY 4.0
- CVE-2026-96222 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences